Overview
- Quirso, which first observed compromised vCenter hosts contacting attacker domains on August 3, reported roughly 361 victim IP addresses spread across 47 countries that reached attacker infrastructure within days of the bug’s disclosure.
- Broadcom published fixes on July 29 for CVE-2026-59310, a Syslog directory-traversal rated 9.8 that can allow unauthenticated remote code execution, but many internet-accessible vCenter instances remain unpatched and at risk.
- After exploiting the flaw attackers placed a malicious cron job and deployed the open-source reverse_ssh tool to create outbound SSH connections that maintain persistent, stealthy access from compromised appliances.
- Detection is tricky because reverse_ssh is also used legitimately, so Quirso published a generic YARA rule and warned defenders to validate builds by looking for unauthorized installs, unexpected outbound connections, and execution artifacts.
- The campaign’s scope and techniques are consistent with an APT-style intrusion and have second-order effects for defenders, who must patch, hunt for compromises, evict persistent access, and monitor increased scanning that may target other vCenter flaws such as CVE-2026-59309.